---

 

HEX View PST Summary

In previous tutorial on Hex View PST file you learned how you can open and view PST file in Hex, verify if opened file is actually a PST peeping PST headers and others. Today I gonna show you how you can delete some of the PST file headers information to actually recover Deleted Items folder contents back if somehow lost. Sound weird?.

 

Video to HEX Corrupt PST File to PST Recovery

 

HEX Concept to PST Recovery

Yes; deleting PST file headers in HEX to corrupt PST file and running scanpst.exe (Outlook Inbox Repair Tool) to recover PST headers actually give you back data from Deleted Items folder if somehow accidentally lost as scanpst.exe while recovering PST file headers take into account PST body part too and recover contents from Deleted Items folders as well.

 

HEX Edit PST File Considerations

Seems obvious? No; actually you need to take care while corrupting PST file headers in HEX as doing it in lax will end up loosing your Outlook PST because scanpst.exe has some constraints to recovery. Over corrupted PST file is out of bounds to scanpst.exe and require professional Outlook Recovery services for its fix.

 

Corrupt PST File Headers in HEX

Open your favourite HEX Editor, mine is i.HEX. Import Outlook PST file from which you you like to recover deleted items.

Clear characters from postion 7 to 13 with spacebar (See the selection) which replaces present character with "20" which is hexadecimal equivalent to space. As you are deleting characters in hexadecimal you end up deleting 13 HEX characters. Its suggested to delete characters from position 7 to 13 referencing ASCII column (right side).

Save and close PST file. You PST file gets corrupted. Verify that by starting your Outlook and it will end up showing error message as:

 

Recover PST file with scanpst.exe

At first storage Offset is in HEX. Unmark HEX as shown and storage offset will present itself in Decimal format.

Run scanpst.exe (Inbox Repair Tool). Scanpst.exe is hidden system file so do ensure to mark the show hidden files and folders option in folder settings of your Windows platform.

On Win2K and WinNT systems, the executable is located at C:\Program Files\Common Files\System\Mapi\1033\NT.
In WinXP: C:\Program Files\Common Files\System\Mapi\1033.

If unable to locate scanpst.exe then go to My Computer and search for scanpst.exe. System will show you executable for Outlook Inbox Repair Tool i.e. Scanpst.exe. Double click scanpst.exe and it will ask you to browse for corrupt PST file you like to recover.

Browse PST file to recover and click "Start". Scanpst.exe will go through 8 passes of PST scan in which it includes deleted items folder to recover as well. Click "Repair".

 

Open Recovered PST file in Outlook

Now start Outlook and BINGO your deleted items are back. Watch out deleted items counter showing your deleted items that you accidentally emptied.

---